{"record":{"id":"df5d203a97d1dad9","repo":"PrefectHQ/fastmcp","slug":"entraobotoken-requires-an-azureprovider-as-the-aut","errorCode":null,"errorMessage":"EntraOBOToken requires an AzureProvider as the auth provider. Current provider: {type(server.auth).__name__}","messagePattern":"EntraOBOToken requires an AzureProvider as the auth provider\\. Current provider: (.+?)","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"fastmcp_slim/fastmcp/server/auth/providers/azure.py","lineNumber":858,"sourceCode":"\n    def __init__(self, scopes: list[str]):\n        self.scopes = scopes\n\n    async def __aenter__(self) -> str:\n        _require_azure_identity(\"EntraOBOToken\")\n\n        from fastmcp.server.dependencies import get_access_token, get_server\n\n        access_token = get_access_token()\n        if access_token is None:\n            raise RuntimeError(\n                \"No access token available. Cannot perform OBO exchange.\"\n            )\n\n        server = get_server()\n        azure_provider = _find_azure_provider(server.auth)\n        if azure_provider is None:\n            raise RuntimeError(\n                \"EntraOBOToken requires an AzureProvider as the auth provider. \"\n                f\"Current provider: {type(server.auth).__name__}\"\n            )\n\n        credential = await azure_provider.get_obo_credential(\n            user_assertion=access_token.token,\n        )\n\n        result = await credential.get_token(*self.scopes)\n        return result.token\n\n\ndef EntraOBOToken(scopes: list[str]) -> str:\n    \"\"\"Exchange the user's Entra token for a downstream API token via OBO.\n\n    This dependency performs a Microsoft Entra On-Behalf-Of (OBO) token exchange,\n    allowing your MCP server to call downstream APIs (like Microsoft Graph) on\n    behalf of the authenticated user.","sourceCodeStart":840,"sourceCodeEnd":876,"githubUrl":"https://github.com/PrefectHQ/fastmcp/blob/1f021142978e0861cd910c8df4e8074bc7cf3978/fastmcp_slim/fastmcp/server/auth/providers/azure.py#L840-L876","documentation":"After obtaining the access token, EntraOBOToken locates the server's auth provider with _find_azure_provider to perform the OBO exchange. If the server's auth provider is not an AzureProvider (or doesn't wrap one), the OBO exchange can't be performed, so it raises RuntimeError naming the actual provider type.","triggerScenarios":"Using EntraOBOToken on a server whose auth is, e.g., JWTVerifier, GoogleProvider, GitHubProvider, or any non-Azure AuthProvider.","commonSituations":"Copy-pasting EntraOBOToken sample code into a project that uses a different identity provider; switching the server's auth provider during migration and leaving OBO token usage in tools; wrapping AzureProvider in a custom AuthProvider that _find_azure_provider doesn't recognize.","solutions":["Set the server's auth to AzureProvider(...): FastMCP(..., auth=AzureProvider(...)).","Remove or gate EntraOBOToken usage in tools when running against non-Azure auth.","If you wrap AzureProvider in a custom provider, make it discoverable by _find_azure_provider or call azure_provider.get_obo_credential directly."],"exampleFix":"// before\nmcp = FastMCP(name=\"app\", auth=GitHubProvider(client_id=cid, client_secret=sec))\n// after\nmcp = FastMCP(name=\"app\", auth=AzureProvider(client_id=cid, client_secret=sec, tenant_id=tid))","handlingStrategy":"type-guard","validationCode":"from fastmcp.server.auth.providers.azure import AzureProvider, _find_azure_provider\nfrom fastmcp.server.dependencies import get_server\nif _find_azure_provider(get_server().auth) is None:\n    raise RuntimeError(\"Server auth must be (or wrap) AzureProvider for EntraOBOToken\")","typeGuard":"def server_uses_azure(auth) -> bool:\n    from fastmcp.server.auth.providers.azure import _find_azure_provider\n    return _find_azure_provider(auth) is not None","tryCatchPattern":"try:\n    async with EntraOBOToken(scopes=[\"api\"]) as t:\n        ...\nexcept RuntimeError as e:\n    if \"requires an AzureProvider\" in str(e):\n        logger.error(f\"Wrong auth provider configured: {e}\")\n    raise","preventionTips":["Configure FastMCP(auth=AzureProvider(...)) wherever OBO tokens are used","Assert the provider type at startup with a smoke check","Search for EntraOBOToken usages when migrating auth providers"],"tags":["python","azure","obo","provider-mismatch","configuration"],"backgroundTag":"auth-provider-mismatch","analyzedSha":"1f021142978e0861cd910c8df4e8074bc7cf3978","analyzedAt":"2026-08-29T14:31:16.082Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}